AI evaluation startup Braintrust confirms unauthorized access to AWS account containing customer API keys

Braintrust discovered unauthorized access to one of its Amazon Web Services (AWS) cloud accounts that contained API keys used by customers to access cloud-based AI models. The company sent an email to customers Monday asking them to rotate their API keys and disclosed the incident on its website Tuesday.

The compromised account held secrets that, if obtained by attackers, could allow them to log into customer systems appearing as legitimate users without breaking into target companies' systems directly. Braintrust said the incident has been contained and it has locked down the compromised account, audited and restricted access across related systems, and rotated internal secrets.

Braintrust spokesperson Martin Bergman told TechCrunch the company sent the email 'out of an abundance of caution' and confirmed a security incident, but stated there is no evidence of a breach at this time. The company has communicated with one impacted customer and to date has not found evidence of broader exposure.